GHSA-R5XW-Q988-826M: mongoose Npm
CVSS: 5.1v3.1MediumPublished
Published 01-09-2020Last modified 07-12-2023
Vulnerability summary
GHSA-R5XW-Q988-826M is a medium (CVSS 5.1) vulnerability in mongoose Npm.
CVSS score
5.1/10
010
Medium · v3.1 (OSV · Npm), selected by version preferenceEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 01-09-2020PublishedVulnerability first disclosed.
- 07-12-2023Last modifiedVulnerability information updated.
Description
Remote Memory Exposure in mongoose Versions of `mongoose` before 4.3.6, 3.8.39 are vulnerable to remote memory exposure. Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database. ## Recommendation Update to version 4.3.6, 3.8.39 or later.
CVSS metrics
1 score · 1 source · 1 versionMedium 5.1Preferred score · OSV · Npm (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesSingle source
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Npm1 product
- mongoose≥ 3.5.5, < 3.8.39 | ≥ 4.0.0, < 4.3.6
1 vendor · 1 product